Title: [271335] branches/safari-610.4.3.0-branch/Source/_javascript_Core
- Revision
- 271335
- Author
- [email protected]
- Date
- 2021-01-08 17:18:52 -0800 (Fri, 08 Jan 2021)
Log Message
Revert r271240. rdar://problem/72935204
Modified Paths
Diff
Modified: branches/safari-610.4.3.0-branch/Source/_javascript_Core/ChangeLog (271334 => 271335)
--- branches/safari-610.4.3.0-branch/Source/_javascript_Core/ChangeLog 2021-01-09 00:10:24 UTC (rev 271334)
+++ branches/safari-610.4.3.0-branch/Source/_javascript_Core/ChangeLog 2021-01-09 01:18:52 UTC (rev 271335)
@@ -1,43 +1,5 @@
2021-01-08 Kocsen Chung <[email protected]>
- Cherry-pick r271240. rdar://problem/72935204
-
- The scratch register should be different from the target register when calling validateUntaggedPtr.
- https://bugs.webkit.org/show_bug.cgi?id=220397
- rdar://72771069
-
- Reviewed by Yusuke Suzuki.
-
- * assembler/MacroAssemblerARM64E.h:
- (JSC::MacroAssemblerARM64E::validateUntaggedPtr):
- - Added an ASSERT to enforce this invariant.
- * jit/ThunkGenerators.cpp:
- (JSC::emitPointerValidation):
- - emitPointerValidation() was reusing the target register as the scratch register.
- This is a hold over from the previous way of doing the validation (which had a
- bug). With the validation bug fixed, this register reuse is no longer allowed.
-
- git-svn-id: https://svn.webkit.org/repository/webkit/trunk@271240 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
- 2021-01-07 Mark Lam <[email protected]>
-
- The scratch register should be different from the target register when calling validateUntaggedPtr.
- https://bugs.webkit.org/show_bug.cgi?id=220397
- rdar://72771069
-
- Reviewed by Yusuke Suzuki.
-
- * assembler/MacroAssemblerARM64E.h:
- (JSC::MacroAssemblerARM64E::validateUntaggedPtr):
- - Added an ASSERT to enforce this invariant.
- * jit/ThunkGenerators.cpp:
- (JSC::emitPointerValidation):
- - emitPointerValidation() was reusing the target register as the scratch register.
- This is a hold over from the previous way of doing the validation (which had a
- bug). With the validation bug fixed, this register reuse is no longer allowed.
-
-2021-01-08 Kocsen Chung <[email protected]>
-
Cherry-pick r271144. rdar://problem/72935400
propertyNameEnumerator must check it can still take the fast path after getGenericPropertyNames
Modified: branches/safari-610.4.3.0-branch/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h (271334 => 271335)
--- branches/safari-610.4.3.0-branch/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h 2021-01-09 00:10:24 UTC (rev 271334)
+++ branches/safari-610.4.3.0-branch/Source/_javascript_Core/assembler/MacroAssemblerARM64E.h 2021-01-09 01:18:52 UTC (rev 271335)
@@ -84,7 +84,6 @@
scratch = getCachedDataTempRegisterIDAndInvalidate();
DisallowMacroScratchRegisterUsage disallowScope(*this);
- ASSERT(target != scratch);
rshift64(target, TrustedImm32(8), scratch);
and64(TrustedImm64(0xff000000000000), scratch, scratch);
or64(target, scratch, scratch);
Modified: branches/safari-610.4.3.0-branch/Source/_javascript_Core/jit/ThunkGenerators.cpp (271334 => 271335)
--- branches/safari-610.4.3.0-branch/Source/_javascript_Core/jit/ThunkGenerators.cpp 2021-01-09 00:10:24 UTC (rev 271334)
+++ branches/safari-610.4.3.0-branch/Source/_javascript_Core/jit/ThunkGenerators.cpp 2021-01-09 01:18:52 UTC (rev 271335)
@@ -49,7 +49,7 @@
isNonZero.link(&jit);
jit.pushToSave(pointerGPR);
jit.untagPtr(tag, pointerGPR);
- jit.validateUntaggedPtr(pointerGPR);
+ jit.validateUntaggedPtr(pointerGPR, pointerGPR);
jit.popToRestore(pointerGPR);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
